Releases and Verification

Releases And Verification

Official Nutify versions are published on the GitHub Releases page.

Release Types

• Public Testing and Release Candidate versions are GitHub pre-releases.
• Stable versions are normal releases and become the latest release.
• Versioned Git and Docker tags are immutable. latest-* Docker tags may move only after a release completes successfully.

Release Downloads

Each Nutify release provides:

• docker-compose.yaml
• docker-compose.oidc.yaml
• docker-compose.hardware.yaml
• .env.example
• a ready-to-extract Compose bundle ZIP
• Docker image names and published digests
• SHA256SUMS
• source ZIP and TAR.GZ archives generated by GitHub

Use the source archives for inspection and development. For normal deployment, use the Compose files and architecture-specific Docker image documented in the release notes.

Verify Downloads

On Linux:

sha256sum --check SHA256SUMS

On macOS:

shasum -a 256 -c SHA256SUMS

A mismatch means the file is incomplete or is not the asset published with that release. Do not deploy it.

Automated Checks

Every push and pull request installs backend dependencies on supported Python versions, compiles the Python source, imports critical runtime packages, audits frontend dependencies, runs ESLint, builds React, checks shell syntax, and validates the base, OIDC, and direct hardware Compose profiles. Publishing a GitHub Release triggers an additional asset checksum verification job.

See CONTRIBUTING.md for local test commands and SECURITY.md for private vulnerability reporting.